auxilo-mcp 0.9.15 → 0.9.17

package/bin/auxilo-cli.js

@@ -22,6 +22,7 @@ const readline = require('readline');
 const { exec } = require('child_process');
 const installer = require('../lib/installer.js');
 const review = require('../lib/review.js');
+const runnerAutoupdate = require('../lib/runner-autoupdate.js');
 const providers = require('../scripts/providers/index.js');
 const byoKeyProvider = require('../scripts/providers/byo-key.js');
 
@@ -186,6 +187,10 @@ const CONSENT_TEXT = `
       other agents unlock your learnings and are not guaranteed. Earnings
       accrue now. Withdrawals open soon, and auxilo.io/status shows where
       things stand.
+    • UPDATES itself once a day from npm. A newer version installs only after
+      its signature and checksum both pass, and if either fails you keep the
+      copy you have. Run auxilo setup --no-autoupdate to decline. auxilo
+      status shows the setting and the last check.
   You can stop any time with \`auxilo disable\` (local kill-switch) and review
   every run in ~/.auxilo/extract.log. Saying No installs the MCP server only.
   No session-end capture hook is written into any client config unless you say
@@ -291,6 +296,15 @@ async function cmdSetup(flags) {
     process.exit(1);
   }
 
+  // RUNNER-AUTO-UPDATE (0.9.16): `--no-autoupdate` persists the opt-out so
+  // every future hook-fired run skips the self-update network check, not
+  // just this invocation of `setup` (env AUXILO_RUNNER_AUTOUPDATE=0 is the
+  // other, per-run-only opt-out — see lib/runner-autoupdate.js).
+  if (flags['no-autoupdate']) {
+    installer.writeRunnerConfig(HOME, { autoupdate: false });
+    console.log('  ✓ Runner auto-update disabled (persisted to ~/.auxilo/runner-config.json)');
+  }
+
   const claudeCode = chosen.find((c) => c.id === 'claude-code');
   if (claudeCode) {
     // LW-18: SessionStart held-count notice ("N learnings held for your
@@ -539,7 +553,20 @@ async function cmdStatus() {
     const reg = c.mcp
       ? (c.registered ? 'MCP registered' : 'detected, MCP NOT registered')
       : 'poll-based source (no MCP config)';
-    console.log(`  ${c.name}: ${reg}`);
+    // MCP-SERVER-STALENESS (0.9.17): show the pin written into this client's
+    // config alongside the installed runner version, so a stale pin (or a
+    // pre-0.9.17 unpinned entry) is visible without opening the config file.
+    let pinNote = '';
+    if (c.mcp && c.registered) {
+      if (c.mcpPin === 'unpinned') {
+        pinNote = ' (pin: unpinned — run `npx auxilo setup` to pin)';
+      } else if (c.mcpPin) {
+        pinNote = c.mcpPinStale
+          ? ` (pin: v${c.mcpPin}, runner: v${s.runnerVersion} — STALE, run \`npx auxilo setup\`)`
+          : ` (pin: v${c.mcpPin})`;
+      }
+    }
+    console.log(`  ${c.name}: ${reg}${pinNote}`);
   }
 
   console.log(`Auth: ${s.auth.credentialsFile
@@ -551,6 +578,13 @@ async function cmdStatus() {
   if (s.runnerInstalled) {
     const line = runnerSkewLine(installer.runnerVersionSkew(HOME));
     if (line) console.log(line);
+    // RUNNER-AUTO-UPDATE (0.9.16): one more line in the same section, no new
+    // heading — auto-update on/off/paused-by-env, last check time, and the
+    // last verification result (if any check has ever run).
+    const autoupdateLine = runnerAutoupdate.runnerAutoupdateStatusLine(
+      runnerAutoupdate.getRunnerAutoupdateStatus(HOME)
+    );
+    if (autoupdateLine) console.log(autoupdateLine);
   }
   console.log(extractionProviderLine(await providers.resolveProvider({})));
   // Lazy require: scripts/runner.js is a heavier module (sources, sensitivity
@@ -1435,10 +1469,12 @@ async function cmdProvider(flags) {
 
 function usage(command) {
   const blocks = {
-    setup: `Usage: auxilo setup [--re-auth] [--base-url <url>]
+    setup: `Usage: auxilo setup [--re-auth] [--base-url <url>] [--no-autoupdate]
 
 Interactively detect clients, register Auxilo, sign in, install the optional
-extraction runner and SessionEnd hook, and record the extraction choice.`,
+extraction runner and SessionEnd hook, and record the extraction choice.
+--no-autoupdate persists opt-out of the runner's self-update check (default:
+on — see AUXILO_RUNNER_AUTOUPDATE=0 for a per-run-only opt-out instead).`,
     init: `Usage: auxilo init [--scope <read|earnings-read|contribute>] [--label <name>]
                    [--env-file <path>] [--save] [--json] [--no-browser]
                    [--base-url <url>]